Subject: [saag] W3C update (CSP, WebAppSec, WebAuthn, WebCrypto)

From: Wendy Seltzer <[email-masked]>
Date: Wed, 16 Nov 2016 19:36:51 -0500

An update on security-related W3C activities:

Content Security Policy Level 2 is a W3C Proposed Recommendation;
development is ongoing in CSP Level 3
   https://www.w3.org/TR/CSP2/
   https://www.w3.org/TR/CSP/

Secure Contexts is a Candidate Recommendation, recommending that user
agents enable some features only when minimum standards of
authentication and confidentiality are met.
   https://www.w3.org/TR/secure-contexts/

Web Authentication Working Group is actively developing the WebAuthn API
based on FIDO2.0 Submissions
   https://www.w3.org/webauthn/
   https://www.w3.org/TR/webauthn/

WebAppSec WG active work includes Upgrade Insecure Requests, Mixed
Content, Secure Contexts (all in Candidate Recommendation); CSP Level 3,
Referrer Policy, Permissions API, UI Security (Ironframe).
   https://www.w3.org/2011/webappsec/
   https://github.com/w3c/webappsec

WebCrypto WG is very nearly done, really!
   https://w3c.github.io/webcrypto/Overview.html

Hardware Based Secure Service CG has a draft report
   https://rawgit.com/w3c/websec/gh-pages/hbss.html

We held a Blockchain and the Web Workshop:
   https://www.w3.org/2016/04/blockchain-workshop/report

Web Payments now includes several drafts and implementations underway:
  https://www.w3.org/Payments/WG/
Payment Request API; Payment Method IDs; Basic Card Payment; HTTP API
1.0; HTTP Messages 1.0; Web Payments Overview

Overview of related groups, including Web Payments:
   https://www.w3.org/Security/

--Wendy

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Policy Counsel and Domain Lead, World Wide Web Consortium (W3C)
http://wendy.seltzer.org/        +1.617.863.0613 (mobile)